PULSE
EN
FEED
ransomorova reclama a Harry's International · SG · Retail & E-Commerceransomeverstake reclama a da*****t.com · Technologyransomeverstake reclama a ra*****g.comransomredact reclama a Holland & Knight · US · Professional Servicesransomqilin reclama a Astino Berhad · MY · Manufacturingransomakira reclama a Princeton Management · Financial Servicesransomakira reclama a Usnextransomakira reclama a Howells Motor Freight · US · Transportationransomsafepay reclama a deom.be · BEransomhyflock reclama a Ateşsan Ambalaj · TR · Manufacturingransompear reclama a Neiman & Company, Inc. · US · Financial Servicesransomn0n reclama a Company #117 · USransomn0n reclama a Company #116 · USransomn0n reclama a Company #115 · USransomorova reclama a Harry's International · SG · Retail & E-Commerceransomeverstake reclama a da*****t.com · Technologyransomeverstake reclama a ra*****g.comransomredact reclama a Holland & Knight · US · Professional Servicesransomqilin reclama a Astino Berhad · MY · Manufacturingransomakira reclama a Princeton Management · Financial Servicesransomakira reclama a Usnextransomakira reclama a Howells Motor Freight · US · Transportationransomsafepay reclama a deom.be · BEransomhyflock reclama a Ateşsan Ambalaj · TR · Manufacturingransompear reclama a Neiman & Company, Inc. · US · Financial Servicesransomn0n reclama a Company #117 · USransomn0n reclama a Company #116 · USransomn0n reclama a Company #115 · US
← Todos los CVEs
CVE Watch18 oct 2026

CVE-2025-10364

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interf

CVSS

—

Sin CVSS

EPSS

6.2%

p93

KEV

—

Exploit Today

28

0-100

Publicado: 12 sept 2025 · Última mod.: 18 oct 2026 · CWE-77

EPSS · 30d
6.2%EPSS · 30 días6.2%
2026-10-042026-11-01
Descripción técnica

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-12034510.0 CRÍ
—
——0A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.7hCVE-2026-12034410.0 CRÍ
—
——0A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.7hCVE-2026-1202829.9 CRÍ
—
——0A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.7hCVE-2026-12028010.0 CRÍ
—
——0A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.7hCVE-2026-12027910.0 CRÍ
—
——0A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.7hCVE-2026-12027710.0 CRÍ
—
——0A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.7h